Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Malicious actors are targeting open-source AI platform MLflow and web-based SCADA software FUXA with critical vulnerabilities.
Two critical vulnerabilities in open-source AI platform MLflow and web-based SCADA software FUXA are being exploited by malicious actors.
The vulnerabilities in question are as follows:
| CVE ID | CVSS Score | Affected Versions | | --- | --- | --- | | CVE-2026-64849 | 9.3 | < 3.15.0 | | CVE-2026-25895 | 9.5 | <= 1.2.9 |
According to independent reports from watchTowr and VulnCheck, the vulnerabilities can allow attackers to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data, or write arbitrary files to the server file system and achieve remote code execution.
WatchTowr reported that attackers are exploiting CVE-2026-64849 to reach cloud metadata services directly and exfiltrate cloud credentials and secrets. The company detected bad actors indiscriminately scanning for exposed MLflow instances online within hours of the CVE being assigned on August 17, 2026.
"It allows an attacker to exploit a flaw in MLflow's model-registry webhooks to proxy requests through the affected system and interact with internal services," said Yordan Ganchev, principal threat intelligence specialist at watchTowr.
The security bug bypasses prior fixes because of how it handles web redirects. Evidence from watchTowr's global honeypot telemetry indicates attackers are abusing this vulnerability to target cloud-hosted MLflow systems in an attempt to extract credentials and secrets from well-known internal IP addresses and services.
Organizations running MLflow are recommended to prioritize patching affected, exposed systems, review audit logs for signs of compromise, and check whether sensitive credentials have been exposed.
As for CVE-2026-25895, VulnCheck reported that it detected malicious scanning aimed at the flaw starting August 18, 2026. A single IP address has been observed broadly scanning the internet for vulnerable FUXA instances. There are about 60 FUXA installations exposed to the public internet.
"The attacker request attempts to overwrite main.js with junk data via the CVE-2026-25895 path traversal," said Caitlin Condon, vice president of research at VulnCheck. "No RCE payloads dropped yet."
Over the past year, two other vulnerabilities in FUXA - CVE-2026-25939 and CVE-2023-33831 - have also witnessed active exploitation efforts, with the latter witnessing activity "dating back to November 2025 and as recently as yesterday," per Condon.
